Package ghidra.program.util
Class ContextEvaluatorAdapter
- java.lang.Object
-
- ghidra.program.util.ContextEvaluatorAdapter
-
- All Implemented Interfaces:
ContextEvaluator
public class ContextEvaluatorAdapter extends java.lang.Object implements ContextEvaluator
Default behavior implementation of ContextEvaluator passed to SymbolicPropogator Override methods to inspect context.
-
-
Constructor Summary
Constructors Constructor Description ContextEvaluatorAdapter()
-
Method Summary
All Methods Instance Methods Concrete Methods Modifier and Type Method Description boolean
allowAccess(VarnodeContext context, Address addr)
Evaluate the address and check if the access to the value in the memory location to be read The address is read-only and is not close to this address.Address
evaluateConstant(VarnodeContext context, Instruction instr, int pcodeop, Address constant, int size, RefType refType)
Evaluate a potential constant to be used as an address or an interesting constant that should have a reference created for it.boolean
evaluateContext(VarnodeContext context, Instruction instr)
Evaluate the current instruction given the final context for the instructionboolean
evaluateContextBefore(VarnodeContext context, Instruction instr)
Evaluate the current instruction given the context before the instruction is evaluatedboolean
evaluateDestination(VarnodeContext context, Instruction instruction)
Evaluate the instruction for an unknown destinationboolean
evaluateReference(VarnodeContext context, Instruction instr, int pcodeop, Address address, int size, RefType refType)
Evaluate the reference that has been found on this instruction.boolean
evaluateSymbolicReference(VarnodeContext context, Instruction instr, Address address)
Evaluate the reference that has been found on this instruction that points into an unknown space that has been designated as tracked.boolean
followFalseConditionalBranches()
Follow all branches, even if the condition evaluates to false, indicating it shouldn't be followed.java.lang.Long
unknownValue(VarnodeContext context, Instruction instruction, Varnode node)
Called when a value is needed for a register that is unknown
-
-
-
Method Detail
-
evaluateContextBefore
public boolean evaluateContextBefore(VarnodeContext context, Instruction instr)
Description copied from interface:ContextEvaluator
Evaluate the current instruction given the context before the instruction is evaluated- Specified by:
evaluateContextBefore
in interfaceContextEvaluator
- Parameters:
context
- describes current state of registersinstr
- instruction whose context has not yet been applied- Returns:
- true if evaluation should stop
-
evaluateContext
public boolean evaluateContext(VarnodeContext context, Instruction instr)
Description copied from interface:ContextEvaluator
Evaluate the current instruction given the final context for the instruction- Specified by:
evaluateContext
in interfaceContextEvaluator
- Parameters:
context
- describes current state of registersinstr
- instruction whose context has been applied- Returns:
- true if evaluation should stop, false to continue evaluation
-
evaluateConstant
public Address evaluateConstant(VarnodeContext context, Instruction instr, int pcodeop, Address constant, int size, RefType refType)
Description copied from interface:ContextEvaluator
Evaluate a potential constant to be used as an address or an interesting constant that should have a reference created for it. Computed values that are not know to be used as an address will be passed to this function. For example a value passed to a function, or a stored constant value.- Specified by:
evaluateConstant
in interfaceContextEvaluator
- Parameters:
context
- current program contextinstr
- instruction on which this reference was detectedpcodeop
- the PcodeOp operation that is causing this potential constantconstant
- constant value (in constant.getOffset() )size
- size of constant value in bytesrefType
- reference type (flow, data/read/write)- Returns:
- the original address unchanged if it should be a reference null if the constant reference should not be created a new address if the value should be a different address or address space Using something like instr.getProgram().getAddressFactory().getDefaultAddressSpace();
-
evaluateReference
public boolean evaluateReference(VarnodeContext context, Instruction instr, int pcodeop, Address address, int size, RefType refType)
Description copied from interface:ContextEvaluator
Evaluate the reference that has been found on this instruction. Computed values that are used as an address will be passed to this function. For example a value passed to a function, or a stored constant value.- Specified by:
evaluateReference
in interfaceContextEvaluator
- Parameters:
context
- current program contextinstr
- instruction on which this reference was detectedpcodeop
- the PcodeOp operation that is causing this referenceaddress
- address being referencedsize
- size of the item being referenced (only non-zero if load or store of data)refType
- reference type (flow, data/read/write)- Returns:
- false if the reference should be ignored (or has been taken care of by this routine)
-
evaluateDestination
public boolean evaluateDestination(VarnodeContext context, Instruction instruction)
Description copied from interface:ContextEvaluator
Evaluate the instruction for an unknown destination- Specified by:
evaluateDestination
in interfaceContextEvaluator
- Parameters:
context
- current register contextinstruction
- instruction that has an unknown destination- Returns:
- true if the evaluation should stop, false to continue evaluation
-
unknownValue
public java.lang.Long unknownValue(VarnodeContext context, Instruction instruction, Varnode node)
Description copied from interface:ContextEvaluator
Called when a value is needed for a register that is unknown- Specified by:
unknownValue
in interfaceContextEvaluator
- Parameters:
context
- current register contextinstruction
- instruction that has an unknown destinationnode
- varnode for the register being accessed to obtain a value- Returns:
- null if the varnode should not have an assumed value. a long value if the varnode such as a Global Register should have an assumed constant
-
followFalseConditionalBranches
public boolean followFalseConditionalBranches()
Description copied from interface:ContextEvaluator
Follow all branches, even if the condition evaluates to false, indicating it shouldn't be followed.- Specified by:
followFalseConditionalBranches
in interfaceContextEvaluator
- Returns:
- true if false evaluated conditional branches should be followed.
-
evaluateSymbolicReference
public boolean evaluateSymbolicReference(VarnodeContext context, Instruction instr, Address address)
Description copied from interface:ContextEvaluator
Evaluate the reference that has been found on this instruction that points into an unknown space that has been designated as tracked.- Specified by:
evaluateSymbolicReference
in interfaceContextEvaluator
- Parameters:
context
- current program contextinstr
- instruction on which this reference was detectedaddress
- address being referenced- Returns:
- false if the reference should be ignored (or has been taken care of by this routine) true to allow the reference to be created
-
allowAccess
public boolean allowAccess(VarnodeContext context, Address addr)
Description copied from interface:ContextEvaluator
Evaluate the address and check if the access to the value in the memory location to be read The address is read-only and is not close to this address.- Specified by:
allowAccess
in interfaceContextEvaluator
- Parameters:
context
- current program contextaddr
- Address of memory where location is attempting to be read- Returns:
- true if the access should be allowed
-
-